Password-protected links

Any link can have a password, on every plan. Visitors get a page asking for it; only the right password sends them on to the destination.

Set a password

1. Open the link in the editor.
2. Under Password, enter a password of 4 to 200 characters and save.
3. Share the password with the people who should get in, separately from the link.

We store only a one-way hash of the password, so nobody — including us — can read it back. To change it, enter a new one. To remove it, choose Remove password. Through the API, send password, or password: null to remove it.

How unlocking works

• The click is recorded once, after the right password, never for the password page itself.
• A correct password unlocks that link in that browser for one hour. Changing the password locks everyone out again.
• Attempts are limited per visitor and link, so passwords cannot be guessed by brute force.
• The form is protected against cross-site request forgery and works on your custom domains too.
• Bots and link previews never see the destination: they only ever get the password page.